3CX Incident Attributed to North Korea; New LockBit MacOS Sample

Mandiant Attributes 3CX Supply Chain Attack to North Korean Activity Cluster

On April 11, 2023, 3CX reported that Mandiant - who investigated the supply chain attack using a digitally signed 3CXDesktopApp installer - attributes the attack to an activity cluster named UNC4736. Mandiant assesses with high confidence that UNC4736 has a North Korean nexus. [1] 

Mandiant´s assessment corroborates findings from Crowdstrike [2] and Kaspersky [3] who analyzed the infected 3CXDesktopApp. Kaspersky discovered a backdoor …

3cx 3cxdesktopapp april assessment attack attributes backdoor cluster crowdstrike findings high incident installer kaspersky korea lazarus lazarus group links lockbit macos mandiant nexus north north korea north korean organization supply supply chain supply chain attack the company umbrella